--- url: "https://xcademia.com/courses/soc-analyst-x-soc" title: "SOC Analyst (X-SOC)" description: "Build SOC analyst capability in 4 days with mentor-led practical scenarios. Learn triage, investigation, evidence capture, and escalation decision-making." publishedAt: "2026-02-26T08:11:19.94711+00:00" updatedAt: "2026-04-30T04:17:14.863493+00:00" type: course code: "CYB-0022" level: Professional duration_days: "4" track: "SOC Analyst & Threat Hunting" category: "Cybersecurity & Ethical Hacking" credential_tier: tier1 price_gbp: "2199" --- # SOC Analyst (X-SOC) > Become confident in SOC triage and investigation with a structured workflow for alerts, evidence capture, and escalation decisions. Mentor-led sessions use practical scenarios to build analyst judgement, communication, and case-handling discipline. ## Overview SOC Analyst (X-SOC) is a hands-on programme designed to build real analyst capability, not just knowledge of tools. You will learn how to triage alerts, investigate suspicious activity, capture defensible evidence, and make escalation decisions that protect the organisation. Delivered through mentor-led sessions, the course uses practical scenarios that mirror real SOC work, including noisy alerts, incomplete context, time pressure, and stakeholder communication. You will practise turning raw signals into structured cases, validating what matters, and documenting actions so your work is repeatable and audit-friendly. Over four days, you will produce analyst-ready deliverables, including case notes, evidence packs, and escalation briefs. Aligned with recognised best practices including ISO, GDPR, NIST and SOC 2, ensuring skills remain practical and deployable in real organisations. All prices are exclusive of VAT (where applicable). Group enrolments and custom packages available. ## Prerequisites - Basic networking concepts (IP, DNS) - Familiarity with Windows fundamentals - Understanding of core security principles ## What you will learn - Design a repeatable SOC triage and investigation workflow. - Analyse alerts to determine severity and confidence. - Implement defensible evidence capture and case documentation. - Lead effective escalation with clear handover briefs. - Communicate investigation updates to stakeholders clearly. - Evaluate case outcomes to improve playbooks and quality. ## Skills you will gain - SOC triage decision-making - Investigation workflow and timelines - Evidence capture and case notes - Severity and confidence scoring - Escalation briefs and handovers - Stakeholder communication updates - Playbook-driven case handling - Case closure and lessons learned ## Career progression - SOC Analyst (Junior) - Security Analyst (Tier 1) - Threat Monitoring Analyst - Cybersecurity Analyst - Incident Response Analyst (Junior) ## Curriculum 1. **Module 1: Getting Ready** - SOC fundamentals: roles, responsibilities, and shift reality - Evidence standards, note-taking templates, and case hygiene - Analyst workflow: triage, investigate, decide, escalate, document 2. **Module 2: SOC Triage Workflow and Analyst Priorities** - Alert context: what to capture first and why - Severity reasoning: impact, likelihood, and confidence - Noise reduction: duplicates, false positives, and tuning feedback - Timeboxing and decision points under pressure 3. **Module 3: Investigation Methods and Evidence Capture** - Building a timeline from limited data - Key artefacts: user, host, IP, process, and authentication signals - Evidence capture that is defensible and audit-friendly - Practical scenarios: turning signals into a structured case 4. **Module 4: Escalation, Handover, and Stakeholder Communication** - When to escalate vs when to monitor - Creating escalation briefs that Tier 2 can action - Writing clear updates for non-technical stakeholders - Containment requests and safety boundaries (process-focused) 5. **Module 5: Common SOC Case Types and Analyst Judgement** - Phishing triage and investigation patterns - Suspicious logins, impossible travel, and credential abuse signals - Malware-style alerts and endpoint investigation concepts - Lateral movement indicators (high level) and escalation triggers 6. **Module 6: Playbooks, Documentation, and Continuous Improvement** - Using playbooks and adapting them responsibly - Case closure standards and lessons learned notes - Metrics that matter: time-to-triage, quality, repeat drivers - Scenario simulations: end-to-end cases with peer review ## Exam & certification You will receive an Xcademia Certificate of Achievement based on strong performance across scenario simulations, the quality of evidence packs, and the clarity of escalation briefs. ## Delivery options - **Live Online** — Join live instructor-led sessions from anywhere. Interactive, engaging, and flexible. - **Onsite Training** — We come to you. Training delivered at your workplace for teams of 6 or more. - **Venue-Based** — Classroom training at a professional venue. Ideal for focused, immersive learning. - **Blended** — Combine online and in-person learning for maximum flexibility and impact. ## Frequently asked questions **What is the difference between Certificate of Completion and Certificate of Achievement?** Completion recognises attendance and participation. Achievement recognises strong performance in scenario simulations, high-quality evidence capture, and clear, action-ready escalation briefs. **Does this course need an exam?** No. There is no external exam required. The Certificate of Achievement is awarded based on practical performance and assessment during the programme. **Do I need a specific SIEM tool to take this course?** No. The programme focuses on analyst workflow and decision-making using tool-agnostic methods and realistic scenarios that apply across SIEM platforms. **What will I produce during the course?** You will produce case notes, investigation timelines, evidence packs, and escalation briefs across multiple SOC-style scenarios. **Is this suitable for someone aiming for a Tier 1 SOC role?** Yes. The course is designed to build Tier 1 analyst readiness, focusing on triage discipline, investigation fundamentals, and escalation decision-making. ## Course at a glance | Field | Value | | --- | --- | | Code | CYB-0022 | | Duration | 4 days | | Level | Professional | | Track | SOC Analyst & Threat Hunting | | Category | Cybersecurity & Ethical Hacking | | Credential tier | tier1 | | Price (GBP) | £2199 | --- ## About this content This Markdown course profile is the citation-grade twin of [SOC Analyst (X-SOC)](https://xcademia.com/courses/soc-analyst-x-soc). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://xcademia.com/courses/soc-analyst-x-soc - Publisher: Xcademia — https://xcademia.com - Catalogue index: https://xcademia.com/llms-full.txt